EUVD-2026-30836
GHSA-v22h-74vw-3j73
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
NULL pointer dereference vulnerability in Samsung Open Source Walrus allows Pointer Manipulation.
This issue affects Walrus: f339b8ee4ea701772e8ae640b3d1b12ac02b1ae9.
AnalysisAI
NULL pointer dereference in Samsung's open-source Walrus WebAssembly runtime crashes the parser when processing malformed WASM binaries, resulting in denial of service. The vulnerability exists in the WASMBinaryReader component (WASMParser.cpp) at commit f339b8ee4ea701772e8ae640b3d1b12ac02b1ae9, where multiple error-handling code paths fail to return early, allowing execution to continue past invalid state and dereference null pointers. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
Walrus (cpe:2.3:a:samsung_open_source:walrus:*:*:*:*:*:*:*:*) is Samsung's open-source WebAssembly runtime engine, which relies on a forked and extended version of the wabt (WebAssembly Binary Toolkit) library for binary parsing. The vulnerability (CWE-476: NULL Pointer Dereference) resides in the WASMBinaryReader class within src/parser/WASMParser.cpp and its associated delegate in third_party/wabt/src/walrus/binary-reader-walrus.cc. The parser processes WASM binary sections sequentially; when a malformed or adversarially crafted WASM file triggers an internal parse error, the absence of early-return guards in at least eleven distinct code paths allows the parser to continue operating on invalid or null state. The fix in PR #409 adds explicit return statements at each of these paths, introduces a PARSER_RESOURCE_LIMIT check for local declaration counts, refactors m_walrusParseError storage from WASMBinaryReader into the base WASMBinaryReaderDelegate class, and adds a CheckParseError() method to BinaryReaderDelegateWalrus to propagate error state cleanly.
RemediationAI
The primary fix is to apply the upstream patch from GitHub PR #409 (https://github.com/Samsung/walrus/pull/409), which adds early-return guards throughout the WASM binary parser and introduces resource limit enforcement for local declarations. Upstream fix is available via the PR commit; a released patched version has not been independently confirmed, so consumers of Walrus should build from the patched branch or cherry-pick the changes into their deployment. Organizations that embed Walrus in a product should monitor the Samsung/walrus GitHub repository for a tagged stable release incorporating this fix. As a compensating control prior to patching, applications using Walrus should validate WASM binary inputs against a strict schema or byte-level allowlist before passing them to the parser, and should run the Walrus parser in an isolated process or sandbox so that a crash does not affect the broader application. Restricting the sources from which WASM binaries are accepted (e.g., rejecting user-supplied or externally-fetched WASM in production) directly reduces attack surface at the cost of reduced functionality.
More in Samsung Open Source
View allHeap buffer overflow in Samsung's rlottie animation rendering library allows remote denial-of-service via maliciously cr
Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to tri
Out-of-bounds write in Samsung's Escargot lightweight JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3
Heap-based buffer overflow in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) all
Use-after-free memory corruption in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d
Out-of-bounds write in Samsung's Escargot JavaScript engine allows attacker-supplied scripts to corrupt memory through t
Integer overflow in Samsung Escargot JavaScript engine allows remote attackers to trigger buffer overflows without authe
NULL pointer dereference in Samsung Open Source Walrus's WebAssembly binary parser causes application-level denial of se
Uncontrolled recursion in Samsung's Escargot JavaScript engine triggers excessive heap allocation, causing a denial-of-s
Denial of service in Samsung Escargot JavaScript engine at commit 590345cc6258317c5da850d846ce6baaf2afc2d3 stems from mu
Denial-of-service in Samsung's Escargot JavaScript engine (commit 590345cc) stems from multiple unhandled exceptional co
Excessive memory allocation in Samsung's Escargot JavaScript engine (commit 590345cc) triggers a denial-of-service condi
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today